Subject: RE: [mobile-ip] LMM requirements: security issue

From: "Hesham Soliman (EAB)" <[email-masked]>
Date: Thu, 5 Sep 2002 19:29:30 +0200

Greg,

In extended Mode with ESP, this will not work,
since it needs to see the ESP payload (the
encapsulated IPv6 packet), which is encrypted.

=> I'm not sure what you mean, if the MAP hits
the ESP/AH header then it knows to not touch the packet
and encapsulate it as is. I prefer your alternative
though (adding a routing header) because I
think it's cleaner. 
So what do others think? we have two options:

1. My initial suggestion (the dirty way) in which
the MAP scans through headers to see if an IPsec
header exists.

2. Require the HA to add a RH to all packets going 
through an IPsec tunnel to the MN. 

1) has the advantage of working without adding 
more requirements on the HA. 2) has the advantage of 
less scanning into the daisy chain for each packet.

Thoughts? 

Hesham

---

From: "James Kempf" <[email-masked]>
Date: Thu, 5 Sep 2002 11:08:43 -0700

Hesham,

> less scanning into the daisy chain for each packet.

Well, I don't like either option. Option 1) requires the MAP to snoop the
packets, which is a very slow and time consuming operation. Option 2) requires
communication between the HA and the MAP.

But, given the choice, I would go for 1). I think it may be a scalability
problem to design in any dependencies between an HA in a foreign domain and the
MAP. Besides, routers will need to scan headers anyway, so there may be some
hardware to accelerate header snooping that could be applied to a MAP.

            jak